Pausa Privacy Policy

App: Pausa (iOS)
Developer / data controller: [NEXAPPS LEGAL ENTITY NAME], [REGISTERED ADDRESS], Türkiye — operated by Furkan Tanrıöver
Contact: support@nexapps.co

1. The short version

Pausa is a perimenopause wellness journal that turns your daily check-ins into a weekly pattern narrative and a report you can bring to your clinician. It is built local-first:

• Your symptom history lives on your iPhone, not on our servers. Daily check-ins (symptoms, severity, sleep, cycle/spotting, HRT/supplement adherence) are stored only in the app’s local database on your device. We do not sync them to iCloud, and we cannot read them.
• The only health data that ever leaves your device is a condensed, pseudonymous summary, sent transiently to generate your weekly narrative or monthly report — and only after you explicitly agree on the in-app consent screen. We never store that summary on our servers.
• The AI analysis is performed by Anthropic, our AI provider. It is named here because you have the right to know exactly who processes your data. Anthropic may not use your data to train its models under our agreement with them.
• No ads. No trackers. No sale of data. Ever. Pausa contains no advertising SDKs and does no cross-app tracking. The App Store privacy label’s “Data Used to Track You” section is empty by design.
• You can delete your account and data from inside the app, and you can revoke AI consent at any time — daily logging keeps working entirely on your device.

The rest of this policy is the long version of those five sentences.

2. Scope and definitions

This policy covers the Pausa iOS app and the nexapps platform services behind it. It does not cover Apple’s own processing (App Store purchases, Sign in with Apple, iOS notifications), which Apple describes in its own privacy documentation.

• On-device data — data stored only in Pausa’s local database on your iPhone.
• Transient AI summary — the condensed, pseudonymous statistics derived from your logs that are sent to generate a narrative or report, processed in memory, and not stored by us.
• Account data — the minimal server-side records that make the service work (a random account identifier, device basics, subscription state).

3. What data we handle, and where it lives

3.1 Data that stays on your iPhone (we never receive it)

Stored in Pausa’s local, on-device database (SwiftData). Excluded from iCloud sync — Apple’s App Review rules (Guideline 5.1.3(ii)) prohibit personal health information in iCloud, and our architecture complies by construction.

• Your daily check-ins: symptom selections (from Pausa’s curated perimenopause symptom list) with 1–5 severity, sleep quality, cycle/spotting entries, and HRT/supplement adherence entries you record.
• Your onboarding symptom-history quiz answers.
• The weekly narratives and monthly Appointment Report PDFs generated for you (they are delivered back to your device and stored there).
• Streaks, reminders, and app preferences.

Notes on control:

• Pausa’s check-in is tap-based; there is no free-text symptom field, so no free-text diary content exists to leave your device.
• You can create an encrypted local export of your data for backup or moving to a new iPhone; you control that file. There is no cross-device cloud sync in this version.
• If you share an Appointment Report with your clinician, you do that yourself through iOS share functions; we are not part of that transmission and never receive the report.
• If you delete the app without exporting, your on-device data is deleted with it.

3.2 The transient AI summary (leaves your device only with your explicit consent)

To write your weekly pattern narrative (about once a week) and your monthly report summary, the app computes a condensed statistical summary on your device and sends it to our AI gateway. This happens only after you have accepted the in-app health-data and AI consent screen, and you can turn it off at any time.

Your de-identified weekly summary is processed by Anthropic, our AI provider.

What the summary contains: aggregated statistics and structured severity series derived from your entries for the period being analyzed — e.g. symptom frequency and severity aggregates, sleep-quality aggregates, cycle-phase markers, and adherence indicators — plus non-identifying request metadata (app identifier, feature name, app version).

What it never contains: your name, email address, phone number, contacts, precise location, advertising identifiers, device fingerprints, photos, or free text (none exists — see §3.1).

The path it takes: your device → the nexapps AI gateway (our server, EU-hosted) → the AI provider, either routed via Cloudflare’s AI gateway service or sent directly to the provider over encrypted connections. The provider is:

• Anthropic PBC (United States) — our AI provider; [VERIFY exact legal entity name with counsel]

What is stored, and by whom:

• nexapps stores none of it. The summary and the generated narrative are processed transiently and are not written to our databases, logs, or backups. Our systems retain only content-free usage metadata about the request (feature name, model used, token counts, latency, processing status, estimated cost) for billing, abuse prevention, and reliability.
• The AI providers may not use your data to train their models under their commercial API terms and our agreements with them. The provider may retain the summary briefly for abuse monitoring — never to train models. Providers may retain API inputs for a short period (e.g. up to 30 days) for abuse monitoring under their standard API terms unless zero-data-retention arrangements apply. [OPEN ITEM: confirm or negotiate zero-data-retention status with the providers before launch and update this sentence to state the verified position.]
• Cloudflare acts as network infrastructure for these calls; request-payload logging in our Cloudflare AI gateway configuration is disabled. [OPEN ITEM: verify payload logging is disabled on the production gateway before launch.]

Provider changes: we name our AI providers here deliberately. Adding or replacing a provider is a change to this policy — we will update it and, where the change is material, ask for your consent again before your data reaches a new provider.

3.3 Account and device data (on our servers)

Pausa works without registration. On first launch the app creates a pseudonymous account:

• A random account identifier (UUID) — not derived from your name, email, phone number, or any Apple identifier.
• Device basics: platform (“ios”), OS version, device model — used for compatibility and abuse prevention.
• Session credentials: short-lived access tokens and rotating refresh tokens (stored server-side only as cryptographic hashes).
• Push notification token, only if you enable notifications.
• Notification preference (marketing_push on/off — see §10).

[IF SIGN IN WITH APPLE SHIPS IN PAUSA v1 — founder decision (recommended and currently specced: anonymous-only, with no Sign in with Apple entry point; shipping it requires counsel review and an App Privacy label re-analysis): If you choose to sign in with Apple, we additionally store your Apple account identifier (apple_sub), your email address if you share it (you may use Apple’s Hide My Email), and an Apple-issued token that lets us revoke the sign-in link when you delete your account. Signing in with Apple links your otherwise pseudonymous account to that email. If Pausa v1 ships anonymous-only, this paragraph is removed.]

3.4 Purchases and subscription state

Payments are processed by Apple through the App Store; we never see your payment card details. To know which features you’re entitled to, we use RevenueCat (subscription management) which processes: your pseudonymous account identifier, product identifier, subscription state (trial, active, cancelled, billing issue, expired), period dates, and store transaction identifiers. Our servers keep a mirror of that entitlement state.

3.5 Usage analytics (content-free, EU-hosted)

We measure how the product performs using PostHog (EU Cloud, hosted in the EU). Analytics never contain your health entries — this is an engineering rule, not just a policy: apps on the nexapps platform cannot send analytics directly; events flow through our server, which stamps identity server-side and forwards a fixed, content-free event taxonomy.

• Examples of events: app opened, onboarding step completed, check-in completed (the fact, never the contents), narrative generated (metadata only), paywall viewed, trial started, subscription renewed, notification opened.
• Properties attached: pseudonymous account identifier, app identifier, subscription status, days since install, app version, platform.
• Never attached: symptom names, severities, cycle data, narrative text, or any health content.
• Onboarding may ask non-clinical product questions (e.g. “where else do you track?”); answers are recorded as content-free analytics choices, not health entries.

3.6 Diagnostics

Crash and error reports via Sentry, configured to scrub personal data. No health content, emails, tokens, or request/response bodies are included in error reports or server logs.

3.7 Transactional email

If we hold an email address for you [only possible with Sign in with Apple — see §3.3], we use Resend to send strictly transactional messages (e.g. account-deletion confirmation). No marketing email.

3.8 What we never collect

No precise location. No contacts. No photos. No microphone. No browsing or search history. No advertising identifiers (no ATT prompt — there is nothing to track). No third-party advertising or tracking SDKs. We do not sell or rent any data, and we do not share any data for advertising. Pausa shows no ads and embeds no third-party trackers or advertising identifiers — there is nothing to track.

3.9 HealthKit import (conditional)

[CONDITIONAL — HealthKit import fork, founder decision at spec review. If the HealthKit read-only import option is approved: Pausa can, at your explicit request and via Apple’s HealthKit permission screen, read the perimenopause-related symptom and cycle types you already log in Apple Health, to include them in your on-device history and narratives. HealthKit data: (a) is stored only on your device like all other health data in Pausa; (b) is never used for advertising or marketing and never shared with third parties except as part of the transient AI summary described in §3.2, under the same consent; (c) is never written back to HealthKit inaccurately; (d) is deleted with the rest of your local data. The App Store privacy label and privacy manifest are updated accordingly before this feature ships. If the fork is declined, this section is removed.]

4. Purposes and legal bases

Health-related data is never used for advertising, marketing, data mining, or any purpose other than the health-management features you asked for (this is also an App Store rule for health apps, Guideline 5.1.3(i), and we adopt it as a binding commitment).

5. Who receives data (named processors)

We use a small number of service providers (“processors”), each under a data-processing agreement obliging protection equal to this policy. We confirm, per Apple Guideline 5.1.1(i), that each provides the same or equal protection of your data as stated here.

We have no advertising partners, no data brokers, and no affiliates. We do not disclose health-related data to any third party except the processors above, for the purposes above, with your consent where required.

6. International transfers

Our servers are in the EU (Germany). Some processors above are in the United States. Where data leaves the EEA/UK/Türkiye:

• GDPR: transfers rely on adequacy decisions, the EU–US Data Privacy Framework (where the processor is certified), and/or Standard Contractual Clauses. [COUNSEL: verify the per-processor mechanism, especially for the primary AI provider.]
• KVKK (Türkiye): cross-border transfers are conducted under KVKK Art. 9 (as amended by Law 7499): standard contracts executed with the relevant processors and notified to the Turkish Data Protection Board within five business days of signature. [OPEN ITEM: this policy must be live before the first App Store submission, which pulls the KVKK transfer package (contracts executed + Board notification filed) forward to mid-August; the default rule is that the policy is not published before that package is in place. COUNSEL to confirm whether the policy may instead publish at submission, with the transfer package completing before soft launch.]

7. Retention and deletion

Deleting your account (in-app)

Settings → Delete Account. This is available to every user, requires no phone call or email, and does the following:

1. Immediately on our servers: your account record and personal data are deleted; devices and session tokens are destroyed; [your Apple sign-in link is revoked with Apple — if Sign in with Apple is linked]; AI usage metadata is unlinked from you.
2. On your device: the app wipes its local database — your symptom history, narratives, and reports are erased (export first if you want to keep them).
3. At our processors (completed within 30 days): deletion of your analytics person profile at PostHog and your subscriber record at RevenueCat.
4. Confirmation: shown in-app [and by email if we hold an email address for you].
5. Backups: deleted records persist only inside encrypted backups until those expire per the schedule above; backups are used solely for disaster recovery and are not used to “restore” deleted accounts.

Important: deleting your account does not cancel an active App Store subscription — Apple controls billing. Cancel in iOS Settings → Apple Account → Subscriptions, ideally before deleting your account. The app reminds you of this in the deletion flow.

You can also revoke AI consent without deleting anything — see §11.

8. Your rights

Depending on where you live, you have the rights below. Exercise any of them in-app (deletion, consent revocation, export) or by contacting support@nexapps.co. We do not discriminate against you for exercising rights.

• Everyone: access/copy of your server-side data; deletion; consent withdrawal; correction; complaint.
• EEA/UK (GDPR Arts. 15–22): access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), withdrawal of consent without affecting prior processing, and complaint to your supervisory authority.
• Türkiye (KVKK Art. 11): learning whether your data is processed, requesting information, learning the purpose, knowing third-party recipients, correction, erasure/destruction (Art. 7), notification of correction/erasure to recipients, objection to solely-automated adverse results, and compensation for unlawful processing. Applications are answered within 30 days per KVKK Art. 13 and the Veri Sorumlusuna Başvuru Tebliği. [Turkish-language application channel to be listed in the Turkish aydınlatma metni.]
• US state health-data laws: see §9.

Most of your data is on your device, where “access” and “portability” are direct: the encrypted local export gives you a complete copy of your health data without asking us.

9. US consumer health data (Washington MHMDA and similar laws)

The section below is our Consumer Health Data notice. It is also published as a standalone Consumer Health Data Notice, which is the authoritative version and the target of every Consumer Health Data link on the site.

This is Pausa’s Consumer Health Data Privacy Policy for the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370), the Connecticut Data Privacy Act’s consumer-health provisions, and similar U.S. state laws.

Categories of consumer health data we collect, and why:

Sources: you (your in-app entries) and your device. Sharing: consumer health data is disclosed only to the processors named in Pausa’s Privacy Policy (AI providers under the transient-summary disclosure, with your consent; infrastructure providers), under contracts restricting use to our instructions. We have no affiliates. We do not sell consumer health data and do not share it for advertising. We do not use geofencing, and specifically do not geofence around any facility providing in-person health care.

Consent: we collect and process consumer health data only with your consent, obtained through a separate, plain-language in-app consent screen (not bundled into general terms acceptance) before any health data leaves your device. Collection limited to your device happens as part of the service you signed up for; nothing is transmitted without the separate consent.

Your rights (WA/NV/CT residents): the right to confirm whether we collect or share consumer health data; to access it, including a list of the third parties (and any affiliates) it was shared with; to withdraw consent; and to have it deleted — including propagation of the deletion to our processors and, on the timeline in Pausa’s Privacy Policy, to backups. Submit requests in-app or to support@nexapps.co. We respond within 45 days (extendable once by 45 days where reasonably necessary). If we refuse a request, you may appeal by replying to our decision or writing to us with the subject “Health data appeal”; we decide appeals within 45 days and, if the appeal is denied, we provide a way to contact the Washington Attorney General (or your state’s equivalent) to raise a concern.

Legal process (our subpoena policy): we do not disclose consumer health data to government entities or litigants except upon valid, binding legal process, which we review and construe narrowly; where lawful, we notify you before disclosure. Structurally, the most protective answer is architectural: we cannot produce symptom histories we do not possess — your logs are on your device, not on our servers, and the transient AI summaries are not stored. What could be produced from our systems is limited to the pseudonymous account, subscription, and content-free usage records described in Pausa’s Privacy Policy.

10. Notifications and marketing choices

• Notifications are optional and controlled by iOS permission; the app never requires them.
• Pausa may send: (a) reminders you set (scheduled on-device), and (b) subscription-lifecycle notifications from our servers (e.g. trial-ending reminders, billing-issue and win-back notices). The promotional/marketing-style ones can be turned off with the in-app notifications toggle (Settings → Notifications), independent of iOS settings, as required by App Store Guideline 4.5.4.
• No marketing email. No third-party marketing of any kind. Health data is never used for marketing (see §4).

11. Consent, and how to revoke it

Before Pausa’s first AI call, you see a consent screen describing exactly what §3.2 describes: what is sent, to whom (Anthropic), and that nothing is stored on our servers. We record the fact, time, and version of your consent (a content-free record) as required by Apple Guideline 5.1.2(i) and applicable law.

• Declining or revoking is a first-class path: daily logging, trends, streaks, and your existing narratives keep working entirely on-device. Only new narratives/reports pause, because they are the feature that needs the AI call.
• Revoke anytime: Settings → Privacy → “Weekly narrative & AI processing” toggle. Revocation stops all future transmissions immediately.
• Re-consent is asked if the named providers or the nature of the data sent materially changes.

12. Security

TLS encryption for everything in transit; local data protected by iOS data protection; session tokens stored in the device Keychain; server-side refresh tokens stored only as hashes; backups encrypted with a key held offline by the founder; EU hosting; strict server hardening; no health content in logs; provider API keys never present in the app. No system is perfectly secure; if a breach affects you, we will notify you and regulators as required by law (including the FTC Health Breach Notification Rule where applicable).

13. Children

Pausa is a perimenopause app for adults. It is not directed to children, and we do not knowingly collect data from anyone under 16. If you believe a child under 16 has used Pausa, contact us and we will delete the associated data.

14. Changes to this policy

We will post changes here with a new effective date, and for material changes (for example, a new AI provider or any new category of data leaving your device) we will notify you in-app and, where required, ask for fresh consent. Prior versions available on request.

15. Contact

[NEXAPPS LEGAL ENTITY NAME] — data controller
[REGISTERED ADDRESS], Türkiye
Email: support@nexapps.co
[EU/UK representative if required — COUNSEL to advise; EEA storefront decision pending.]

For Türkiye-specific KVKK applications, the Turkish aydınlatma metni and application form govern. [Link when published.]